Device, system and method of maintaining connectivity over a virtual private network (VPN)

ABSTRACT

Some demonstrative embodiments include devices, systems and/or methods of maintaining connectivity over a Virtual-Private-Network (VPN). For example, a system may include a server to communicate with at least one computing device via a VPN tunnel, to receive from the computing device a mode indication indicating that the computing device is in a standby mode, to receive from at least one application server one or more packets intended for the computing device when the computing device is in the standby mode, based on at least one filtering criterion, to detect at least one targeted packet to be provided to the computing device, and to transfer the targeted packet to the computing device via the VPN tunnel.

CROSS REFERENCE

This application is a National Phase Application of PCT InternationalApplication No. PCT/US2011/054451, International Filing Date Sep. 30,2011, the entire disclosure of which is incorporated herein byreference.

BACKGROUND

A computing device may operate in an Always On Always Connected (AOAC)mode. In the AOAC mode, the computing device may have a continuousnetwork connection to one or more designated application servers (“theapplication servers”), e.g., enterprise application servers, via acommunication network, while the computing device is operating in astandby mode, e.g., having relatively low power consumption.

When operating in the AOAC mode, the computing device may keep thenetwork connection open in order to receive updates from the applicationservers to one or more applications installed on the computing device(“the client applications”). For example, a computing device running anemail application, may keep the network connection open, while in thestandby mode, in order to update the email application from an emailapplication server.

Upon receiving a targeted packet, e.g., indented to the clientapplications, the computing device may be switched to an active mode,e.g., full operational mode, and may activate the client applications inorder to receive and handle the targeted packet. For example, a notebookin standby mode, e.g., having the notebook lid closed, may be activatedand may activate the mail application upon receiving an email messageindented to the computing device.

In order to avoid activating the computing device by an unauthorizedincoming packet, e.g., a packet not intended to any of the clientapplications, the computing device may utilize a filtering criterion torecognize and filter received packets before activating the computingdevice.

BRIEF DESCRIPTION OF THE DRAWINGS

For simplicity and clarity of illustration, elements shown in thefigures have not necessarily been drawn to scale. For example, thedimensions of some of the elements may be exaggerated relative to otherelements for clarity of presentation. Furthermore, reference numeralsmay be repeated among the figures to indicate corresponding or analogouselements. The figures are listed below.

FIG. 1 is a schematic block diagram illustration of a system, inaccordance with some demonstrative embodiments.

FIG. 2 is a schematic flow-chart illustration of a method of maintainingconnectivity over a Virtual Private Network (VPN), in accordance withsome demonstrative embodiments.

FIG. 3 is a schematic illustration of an article of manufacture, inaccordance with some demonstrative embodiments.

DETAILED DESCRIPTION

In the following detailed description, numerous specific details are setforth in order to provide a thorough understanding of some embodiments.However, it will be understood by persons of ordinary skill in the artthat some embodiments may be practiced without these specific details.In other instances, well-known methods, procedures, components, unitsand/or circuits have not been described in detail so as not to obscurethe discussion.

Discussions herein utilizing terms such as, for example, “processing”,“computing”, “calculating”, “determining”, “establishing”, “analyzing”,“checking”, or the like, may refer to operation(s) and/or process(es) ofa computer, a computing platform, a computing system, or otherelectronic computing device, that manipulate and/or transform datarepresented as physical (e.g., electronic) quantities within thecomputer's registers and/or memories into other data similarlyrepresented as physical quantities within the computer's registersand/or memories or other information storage medium that may storeinstructions to perform operations and/or processes.

The terms “plurality” and “a plurality” as used herein include, forexample, “multiple” or “two or more”. For example, “a plurality ofitems” includes two or more items.

Some embodiments may be used in conjunction with various devices andsystems, for example, a Personal Computer (PC), a desktop computer, amobile computer, a laptop computer, a notebook computer, a tabletcomputer, a server computer, a handheld computer, a handheld device, aPersonal Digital Assistant (PDA) device, a handheld PDA device, anon-board device, an off-board device, a hybrid device, a vehiculardevice, a non-vehicular device, a mobile or portable device, a consumerdevice, a non-mobile or non-portable device, a wireless communicationstation, a wireless communication device, a wireless Access Point (AP),a wired or wireless router, a wired or wireless modem, a video device,an audio device, an audio-video (A/V) device, a Set-Top-Box (STB), aBlu-ray disc (BD) player, a BD recorder, a Digital Video Disc (DVD)player, a High Definition (HD) DVD player, a DVD recorder, a HD DVDrecorder, a Personal Video Recorder (PVR), a broadcast HD receiver, avideo source, an audio source, a video sink, an audio sink, a stereotuner, a broadcast radio receiver, a flat panel display, a PersonalMedia Player (PMP), a digital video camera (DVC), a digital audioplayer, a speaker, an audio receiver, an audio amplifier, a gamingdevice, a data source, a data sink, a Digital Still camera (DSC), awired or wireless network, a wireless area network, a Wireless VideoArea Network (WVAN), a Local Area Network (LAN), a Wireless LAN (WLAN),a Wireless Metropolitan Area Network (WMAN) communication system, aPersonal Area Network (PAN), a Wireless PAN (WPAN), devices and/ornetworks operating in accordance with existing IEEE 802.11 standards(“the 802.11 standards”), e.g., including IEEE 802.11 (IEEE 802.11-2007:Standard for Information technology—Telecommunications and informationexchange between systems—Local and metropolitan area networks—Specificrequirements, Part 11: Wireless LAN Medium Access Control (MAC) andPhysical Layer (PHY) Specifications—June 2007), and/or future versionsand/or derivatives thereof, devices, and/or networks operating inaccordance with IEEE 802.16 standards (“the 802.16 standards”), e.g.,including 802.16 (IEEE-Std 802.16, 2004 Edition, Air Interface for FixedBroadband Wireless Access Systems), standards and/or future versionsand/or derivatives thereof, devices, and/or networks operating inaccordance with existing Wireless-Gigabit-Alliance (WGA) and/orWirelessHD™ specifications and/or future versions and/or derivativesthereof, devices and/or networks operating in accordance with existingcellular specifications and/or protocols, e.g., 3rd GenerationPartnership Project (3GPP), 3GPP Long Term Evolution (LTE), and/orfuture versions and/or derivatives thereof, units and/or devices whichare part of the above networks, one way and/or two-way radiocommunication systems, cellular radio-telephone communication systems, acellular telephone, a wireless telephone, a Personal CommunicationSystems (PCS) device, a PDA device which incorporates a wirelesscommunication device, a mobile or portable Global Positioning System(GPS) device, a device which incorporates a GPS receiver or transceiveror chip, a device which incorporates an RFID element or chip, a MultipleInput Multiple Output (MIMO) transceiver or device, a device having oneor more internal antennas and/or external antennas, Digital VideoBroadcast (DVB) devices or systems, multi-standard radio devices orsystems, a wired or wireless handheld device (e.g., BlackBerry, PalmTreo), a Wireless Application Protocol (WAP) device, or the like.

Some embodiments may be used in conjunction with one or more types ofwireless communication signals and/or systems, for example, RadioFrequency (RF), Infra Red (IR), Frequency-Division Multiplexing (FDM),Orthogonal FDM (OFDM), Time-Division Multiplexing (TDM), Time-DivisionMultiple Access (TDMA), Extended TDMA (E-TDMA), General Packet RadioService (GPRS), extended GPRS, Code-Division Multiple Access (CDMA),Wideband CDMA (WCDMA), CDMA 2000, single-carrier CDMA, multi-carrierCDMA, Multi-Carrier Modulation (MDM), Discrete Multi-Tone (DMT),Bluetooth®, Global Positioning System (GPS), Wi-Fi, Wi-Max, ZigBee™,Ultra-Wideband (UWB), Global System for Mobile communication (GSM), 2G,2.5G, 3G, 3.5G, Enhanced Data rates for GSM Evolution (EDGE), or thelike. Other embodiments may be used in various other devices, systemsand/or networks.

The term “wireless device” as used herein includes, for example, adevice capable of wireless communication, a communication device capableof wireless communication, a communication station capable of wirelesscommunication, a portable or non-portable device capable of wirelesscommunication, or the like. In some demonstrative embodiments, awireless device may be or may include a peripheral that is integratedwith a computer, or a peripheral that is attached to a computer. In somedemonstrative embodiments, the term “wireless device” may be used toprovide a wireless service.

The terms “powering down” and “power down” as used herein with relationto a device, unit, element, module and/or a component may refer, forexample, to reducing, diminishing, shutting down, powering off, turningoff and/or switching off the electrical current to the device, unit,element, module and/or a component, and/or to switching the device,unit, element, module and/or a component to operate at a sleep mode, areduced-power mode, a hibernate mode, a stand-by mode and/or any otheroperation mode which consumes less power than required for full and/ornormal operation of the device, unit, element, module and/or acomponent. For example, powering down a computing device, e.g., acomputing device which is configured to receive, handle and/or process amessage, a component of a computing device, one or more hardware (HW)and/or software (SW) components of the computing device, and/or anOperating System (OS) of the computing device may include reducing,diminishing, shutting down, powering off, turning off and/or switchingoff the electrical current to the computing device, the component of thecomputing device, the one or more HW and/or software SW components ofthe computing device, and/or the OS of the computing device; and/or toswitching the computing device, the component of the computing device,the one or more HW and/or software SW components of the computingdevice, and/or the OS of the computing device to operate at a sleepmode, a reduced-power mode, a hibernate mode, a stand-by mode and/or anyother operation mode which consumes less power than required for fulloperation, e.g., for full reception, handling, and/or processing themessage.

The terms “powering up” and “power up” as used herein with relation to adevice, unit, element, module and/or a component may refer, for example,to enhancing, resuming, turning on and/or switching on the electricalcurrent to the device, unit, element, module and/or a component, and/orto switching the device, unit, element, module and/or a component fromsleep mode, stand by mode or any other operation mode, which consumesless power than required for full reception and/or normal operation ofthe device, unit, element, module and/or a component, and/or toswitching the device, unit, element, module and/or a component, tooperational mode. For example, powering up a computing device, e.g., acomputing device which is configured to receive, handle, and/or processa message, a component of a computing device, one or more HW and/or SWcomponents of the computing device, and/or an OS of the computing devicemay include enhancing, resuming, turning on and/or switching on theelectrical current to the computing device, the component of thecomputing device, the one or more HW and/or software SW components ofthe computing device, and/or the OS of the computing device; and/or tochanging the computing device, the component of the computing device,the one or more HW and/or software SW components of the computingdevice, and/or the OS of the computing device from sleep mode, areduced-power mode, a hibernate mode, a stand-by mode and/or any otheroperation mode which consumes less power than required for fulloperation, to operational mode, e.g., for full reception, handlingand/or processing the message.

The term “Always-On-Always-Connected (AOAC)” as used herein withrelation to a computing device may refer to a reduced-power state and/ormode, e.g., a very low power state and/or mode, of operation of thecomputing device, at which one or more units, elements and/or componentsof the computing device are powered down, such that the computing devicemay operate at a reduced power consumption, e.g., at a very low powerconsumption, while maintaining connectivity, e.g., substantiallyconstant connectivity, to one or more network services and/orapplications. For example, a mobile computing device, e.g., a handhelddevice, a cell phone, a notebook computer, and the like, may operate ata AOAC state to provide user-perceived constant connectivity to one ormore services and/or applications, e.g., an email service, an Instantmessaging (IM) service, a Voice Over Internet Protocol (VoIP) service,and the like, while maintaining a relatively low level of usage of abattery of the mobile computing device. In one example, a notebookcomputer may be configured to switch from an active state to an AOACstate, e.g., when a user closes a lid of the notebook computer. Duringthe AOAC state, the notebook computer may power down one or morecomponents of the notebook computer, e.g., a core processor, a display,a memory, a chipset, a hard disk, and the like, while one or morecomponents, e.g., a network communication module, may remain active todetect one or more messages from a predefined network service and/orapplication.

In some demonstrative embodiments, a computing device may communicatewith one or more application servers to receive packets, e.g., intendedfor one or more applications (“device applications”) executed by thecomputing device. For example, a notebook, which executes an emailapplication may communicate with an enterprise email server to receivemail messages intended for the email application.

In some demonstrative embodiments, the computing device may maintain acontinuous network connection to the application servers, e.g., toreceive the packets and keep the device applications updated.

In some demonstrative embodiments, the computing device may operate atan AOAC mode, and upon receiving the packets, the computing device maybe switched to an active mode to receive and handle the packets. Forexample, the notebook may operate in the standby mode, and may beactivated upon receiving a mail message from the enterprise emailserver.

In some demonstrative embodiments, in order to avoid activating thecomputing device by an unauthorized incoming packet, e.g., a packet notintended for any of the client applications, a suitable filteringcriterion may be implemented to recognize and filter packets beforeactivating the computing device.

In some demonstrative embodiments, the computing device may include aVirtual-Private-Network (VPN) module to communicate with a VPN servervia a VPN tunnel. For example, an enterprise may use a VPN over a publiccommunication network to increase security.

In some demonstrative embodiments, the utilization of the VPN mayprevent the computing device from detecting and recognizing the targetedpackets, for example, due to the VPN encryption.

In some demonstrative embodiments, if all the incoming packets aretransferred to the computing device, the power consumption of thecomputing device may be increased, for example, if the computing deviceis activated e.g., powered up, periodically in order to detect and checkthe incoming packets, or if the computing device is constantlyactivated, e.g., operating in full operational mode, to receive andhandle the incoming packets.

In some demonstrative embodiments, the VPN server may be configured toact as a proxy filter for filtering packets for the computing device,when the device is operating in standby mode.

In some demonstrative embodiments, the VPN server may be configured toreceive incoming packets from the application servers, to detect andrecognize the targeted packets, and once detected, the VPN server maytransfer the targeted packets to the computing device. Accordingly, theutilization of the VPN server to detect and recognize the incomingpackets may enable the computing device to operate in the AOAC modeefficiently, while maintaining connectivity to the application serversover the VPN, e.g., without increasing the power consumption of thecomputing device, and/or without compromising the security of the VPN.

In some demonstrative embodiments, the computing device may include anagent module configured to provide the VPN server with a mode indicationindicating that the computing device is operating in a standby mode.

In some demonstrative embodiments, the VPN server may be configured toapply at least one filtering criterion to one or more of the incomingpackets received from at least one application server, when thecomputing device is in the standby mode.

In some demonstrative embodiments, the VPN server may be configured todetect at least one targeted packet to be provided to the computingdevice based on the filtering criterion, and to transfer the targetedpacket to the computing device via the VPN tunnel.

In some demonstrative embodiments, the computing device may include acommunication module configured to communicate with the VPN server overa communication channel, to receive a wake packet from the VPN server,prior to receiving the targeted packet, and to cause the computingdevice to switch from the standby mode to the active mode upon receivingthe wake packet.

Reference is now made to FIG. 1, which schematically illustrates a blockdiagram of a communication system 100, in accordance with somedemonstrative embodiments.

In some demonstrative embodiments, system 100 may include one or morecomputing devices, e.g., computing device 102, capable of communicatingwith one or more servers, over at least one communication network 129,e.g., as described below.

In some demonstrative embodiments, communication network 129, mayinclude, for example, any suitable wired and/or wireless communicationnetwork.

In some demonstrative embodiments, communication network 129 may includea public, e.g., unsecured and/or open, communication network.

In some demonstrative embodiments, device 102 may include, or may beincluded as part of, for example, a PC, a desktop computer, a mobilecomputer, a laptop computer, a notebook computer, a tablet computer, aserver computer, a handheld computer, a handheld device, a PDA device, ahandheld PDA device, an on-board device, an off-board device, a hybriddevice (e.g., combining cellular phone functionalities with PDA devicefunctionalities), a consumer device, a vehicular device, a non-vehiculardevice, a mobile or portable device, a non-mobile or non-portabledevice, a cellular telephone, a PCS device, a PDA device whichincorporates a wireless communication device, a mobile or portable GPSdevice, a DVB device, a relatively small computing device, a non-desktopcomputer, a “Carry Small Live Large” (CSLL) device, an Ultra MobileDevice (UMD), an Ultra Mobile PC (UMPC), a Mobile Internet Device (MID),an “Origami” device or computing device, a device that supportsDynamically Composable Computing (DCC), a context-aware device, a videodevice, an audio device, an A/V device, a STB, a BD player, a BDrecorder, a DVD player, a HD DVD player, a DVD recorder, a HD DVDrecorder, a PVR, a broadcast HD receiver, a video source, an audiosource, a video sink, an audio sink, a stereo tuner, a broadcast radioreceiver, a flat panel display, a PMP, a DVC, a digital audio player, aspeaker, an audio receiver, a gaming device, an audio amplifier, a datasource, a data sink, a DSC, a media player, a Smartphone, a television,a music player, or the like.

In some demonstrative embodiments, device 102 may also include, forexample, one or more of a processor 114, an input unit 106, an outputunit 108, a memory unit 110, and a storage unit 112. Device 102 mayoptionally include other suitable hardware components and/or softwarecomponents. In some embodiments, some or all of the components of device102 may be enclosed in a common housing or packaging, and may beinterconnected or operably associated using one or more wired orwireless links. In other embodiments, components of device 102 may bedistributed among multiple or separate devices or locations.

Processor 114 includes, for example, a Central Processing Unit (CPU), aDigital Signal Processor (DSP), one or more processor cores, asingle-core processor, a dual-core processor, a multiple-core processor,a microprocessor, a host processor, a controller, a plurality ofprocessors or controllers, a chip, a microchip, one or more circuits,circuitry, a logic unit, an Integrated Circuit (IC), anApplication-Specific IC (ASIC), or any other suitable multi-purpose orspecific processor or controller. Processor 114 executes instructions,for example, of an Operating System (OS) of device 102 and/or of one ormore suitable applications.

Input unit 106 includes, for example, a keyboard, a keypad, a mouse, atouch-pad, a track-ball, a stylus, a microphone, or other suitablepointing device or input device. Output unit 108 includes, for example,a monitor, a screen, a flat panel display, a Cathode Ray Tube (CRT)display unit, a Liquid Crystal Display (LCD) display unit, a plasmadisplay unit, one or more audio speakers or earphones, or other suitableoutput devices.

Memory unit 110 includes, for example, a Random Access Memory (RAM), aRead Only Memory (ROM), a Dynamic RAM (DRAM), a Synchronous DRAM(SD-RAM), a flash memory, a volatile memory, a non-volatile memory, acache memory, a buffer, a short term memory unit, a long term memoryunit, or other suitable memory units. Storage unit 112 includes, forexample, a hard disk drive, a floppy disk drive, a Compact Disk (CD)drive, a CD-ROM drive, a DVD drive, or other suitable removable ornon-removable storage units. Memory unit 110 and/or storage unit 112,for example, may store data processed by device 102.

In some demonstrative embodiments, device 102 may include one or moreAOAC applications 127. AOAC applications 127 may include one or moreclient applications or services, e.g., Email, Instant Messaging (IM),and/or Voice Over Internet Protocol (VoIP), services and/orapplications, and the like, which require maintaining connectivity inthe AOAC mode

In some demonstrative embodiments, AOAC applications 127 may require acontinuous connectivity to communication network 129 in order to receiveupdates and keep AOAC applications 127 updated from one or more AOACapplication servers 137.

In some demonstrative embodiments, AOAC application servers 137 mayinclude one or more application servers, e.g., email server, Instantmessaging (IM) server and/or Voice Over Internet Protocol (VoIP) server,and the like, which may provide messages, information and/or updates toAOAC applications 127

In some demonstrative embodiments, AOAC application servers 137 may beconfigured to update AOAC applications 127 by sending packets 138, e.g.,intended to device 102, configured to update AOAC applications 127, viacommunication network 129.

In some demonstrative embodiments, device 102 may include at least onecommunication module 124 configured to communicate over communicationnetwork 129. For example, communication module 124 may include awireless communication module, e.g., a wireless NIC, if communicationnetwork 129 includes a wireless communication network. Communicationmodule 124 may communicate messages between AOAC applications 127 andAOAC application servers 137. For example, an Email application, mayreceive email messages from email server via communication module 124.

In some demonstrative embodiments, device 102 may be configured tooperate in an Always On Always Connected (AOAC) mode. For example, whenoperating in the AOAC mode, one or more units, elements and/orcomponents of device 102 may be powered down, while maintainingconnectivity, e.g., substantially constant connectivity, to one or morenetwork services and/or applications, e.g., as described below. Forexample, device 102 may include a notebook which operates in a standbymode, e.g., having the notebook lid closed, while maintainingconnectivity to AOAC application servers 137 over a wirelesscommunication network 129, in order to update AOAC applications 127.

In some demonstrative embodiments, device 102 may be capable ofswitching the mode of operation of one or more components of device 102from the standby mode to an active mode, in which device 102 may bepowered up to full operational mode, e.g., for full reception, handlingand/or processing communication, tasks and the like.

In some demonstrative embodiments, system 100 may implement a VPN toconnect device 102 and AOAC application servers 137 via communicationnetwork 129, e.g., in order to maintain a secure connection betweendevice 102 and AOAC application servers 137. For example, an enterprisemay wish to provide a user of AOAC applications 127, e.g., an emailapplication running on a notebook or a Smartphone, with access toapplication servers 137, e.g., an enterprise Email server, via a secureconnection, over a public communication network.

In some demonstrative embodiments, device 102 may include a VPN clientmodule 120 configured to enable VPN communication over communicationnetwork 129.

In some demonstrative embodiments, system 100 may include a VPN server130 configured to enable VPN communication between device 102 and AOACapplication servers 137, via a VPN tunnel 109 over communication network129. For example, VPN server 130 may be utilized as a proxy server todevice 102.

In some demonstrative embodiments, VPN tunnel 109 may be configured totunnel the communication between computing device 102 and AOACapplication servers 137 over communication network 129, e.g., byencrypting communications between VPN client module 120 and VPN clientserver 130, and decrypting the communications, as received by each ofthe sides of tunnel 109.

In some demonstrative embodiments, VPN server 130 may be configured toapply at least one filtering criterion 136 to detect at least onetargeted packet to be provided to device 102. For example, filteringcriterion 136 may define one or more rules or conditions to be appliedfor filtering messages from application servers 137. Filtering criterion136 may be based on one or more attributes of the user of computingdevice 102, one or more attributes of computing device 102, one or moreattributes of AOAC applications 127, one or more attributes of serverapplication 137, and the like. For example, a filtering criterionrelating to an email application may define one or more rules forfiltering one or more emails from an email server based, for example, ona content of the email, a sender of the email, and the like. Accordingto this example, VPN server 130 may filter incoming email messages basedon filtering criterions 136, to determined which email message should beprovided to AOAC applications 127 of computing device 102, whencomputing device is operating in standby mode.

In some demonstrative embodiments, filtering criterion 136 may include afiltering policy to be applied to a group of computer devices, e.g., agroup of enterprise computing devices, which may include device 102. Forexample, filtering criterion 136 may be defined and/or configuredaccording to a centralized IT application database policy and/or acentralized enterprise policy. The filtering policy may define, one ormore applications of AOAC applications 127 may be authorized to receivepackets while computer device 102 is in the standby mode. For example,filtering criterion 136 may include an enterprise filtering policydefining that only messages intended to one or more predefinedapplications, e.g., only messages intended to an email application,should be provided to computing device 102, when operating in standbymode, while messages of other applications, e.g., VoIP applications, arenot to be provided to computing device 102, when operating in standbymode.

In some demonstrative embodiments, filtering criterion 136 may bedirectly loaded into VPN server 130. For example, filtering criterion136 may be loaded and/or updated, e.g., by an administration manager,during initialization and/or configuration of VPN server 130.

In some demonstrative embodiments, computing device 102 may include anAOAC agent 126 configured to provide VPN server 130 with filteringcriterions 136 to be applied one or more incoming packets, in order todetect a targeted packet to device 102. For example, AOAC agent 126 maygather filtering information from AOAC application 127 to define and/orupdate filtering criterion 136. For example, AOAC agent 126 may receivean indication of which of AOAC applications 127 are to receive packetsduring standby and/or which rules are to be applied by filteringcriterion.

In some demonstrative embodiments, AOAC agent 126 may be configured tocommunicate with VPN server 130 via an Application-Programming-Interface(API) 125. For example, AOAC agent 126 and VPN server 130 may share apredefined set of messages to communicate with each other overcommunication network 129 in order to facilitate communication betweenAOAC agent 126 and VPN server 130.

In some demonstrative embodiments, AOAC agent 126 may be configured tocommunicate with VPN server 130 via VPN tunnel 130.

In some demonstrative embodiments, AOAC agent 126 may be configured toprovide to VPN server 130 a mode indication 128 indicating that device102 is in standby mode. AOAC agent 126 may provide indication 128 viaVPN tunnel 130, or directly via API 125. For example, API 125 betweenAOAC agent 126 and VPN server 130 may include a predefined sharedmessage indicating to VPN server 130 that device 102 is in the standbymode of operation.

In some demonstrative embodiments, VPN server 130 may be configured toreceive from at least one of AOAC application servers 137 one or moreincoming packets 138 intended for device 102, when device 102 is in thestandby mode.

In some demonstrative embodiments, VPN server 130 may be configured toblock all incoming packets 138, except for packets detected as targetedpackets, while device 102 is in the standby mode.

In some demonstrative embodiments, VPN server 130 may be configured tosend to AOAC application servers 137 one or more messages 133 indicatethat device 102 is in the active mode, when device 102 is actually atthe standby mode, e.g., in order to ensure that AOAC application servers137 may keep sending to server 130 packets intended for device 102. Forexample, messages 133 may include periodic keep-alive messages.

In some demonstrative embodiments, communication module 124 may beconfigured to send VPN server 130 one or more messages 123 to indicatethat the connection between VPN server 130 and VPN client 120 should bemaintained, when device 102 is in the standby mode. For example,messages 123 may include periodic keep-alive messages.

In some demonstrative embodiments, VPN server 130 may detect a targetedpacket 139, e.g., intended to be provided to AOAC applications 127according to filtering criterion 136, and may transfer targeted packet139 to device 102 via VPN tunnel 109. For example, VPN server may detecttargeted packet 139 to include a packet in compliance with filteringcriterion 136.

In some demonstrative embodiments, VPN tunnel 109 may be maintainedactive when device 102 is in the standby mode. According to theseembodiments, the reception of targeted packet 139 via VPN tunnel 109 maycause one or more components of device 102 to be switched to the activemode. For example, communication module 124 may be configured to switchdevice 102 from the standby mode to the active mode, upon receivingtargeted packet 139.

In some demonstrative embodiments, VPN tunnel 109 may be deactivatedwhen device 102 is in the standby mode. According to these embodiments,VPN server 130 may be configured to send communication module 124 a wakepacket 132 over communication network 129, e.g., outside of VPN tunnel109, before transferring targeted packet 139. Computing device 102 mayswitch from the standby mode to the active mode, upon receiving wakepacket 132. For example, communication module 124 may power up, one ormore components of computing device 102 upon receiving wake packet 132.Device 102 may re-establish VPN tunnel 109, e.g., once computing devicehas switched to the active mode, in order to enable the transferring oftargeted packet 139 to AOAC application 127 via VPN tunnel 109.

In some demonstrative embodiments, device 102 may handle the targetedpacket 139 and may transfer targeted packet 139 to AOAC applications 127for further processing.

Reference is now made to FIG. 2, which schematically illustrates amethod of maintaining connectivity over a VPN, in accordance with somedemonstrative embodiments. In some demonstrative embodiments, one ormore of the operations of the method of FIG. 2, may be performed by asystem, e.g., system 100 (FIG. 1); a computing device, e.g., device 102(FIG. 1); a server, e.g., VPN server 130 (FIG. 1); and/or a clientmodule, e.g., VPN client module 120 (FIG. 1).

In some demonstrative embodiments, as indicated at block 201, the methodmay include receiving at least one filtering criterion to be applied toone or more packets received from at least one application server. Forexample, VPN server 130 (FIG. 1) may receive filtering criterion 136(FIG. 1) from AOAC agent 126 (FIG. 1), e.g., as described above.

In some demonstrative embodiments, as indicated at block 202, receivingthe filtering criterion may include receiving a filtering policy to beapplied to a group of computing devices including the computing device.For example, VPN server 130 (FIG. 1) may receive filtering criterion 136(FIG. 1) including a filtering policy to be applied to a group ofcomputing devices including device 102 (FIG. 1), e.g., as describedabove.

In some demonstrative embodiments, as indicated at block 203, the methodmay include receiving from the computing device a mode indicationindicating that the computing device is in a standby mode. For example,VPN server 130 (FIG. 1) may receive mode indication 128 (FIG. 1) fromAOAC agent 126 (FIG. 1) indicating that device 102 (FIG. 1) is in thestandby mode, e.g., as described above.

In some demonstrative embodiments, as indicated at block 205, the methodmay include, sending to the application server one or more messagesindicating that the computing device is in an active mode, when thecomputing device is in the standby mode. For example, VPN server 130(FIG. 1) may send to AOAC application servers 137 (FIG. 1) messages 133,indicating that device 102 is in the active mode, when device 102(FIG. 1) is in the standby mode, e.g., as described above.

In some demonstrative embodiments, as indicated at block 206, the methodmay include, receiving from the computing device one or more messagesindicating that a connection between the computing device and the VPNserver is to be maintained, when the computing device is in the standbymode. For example, VPN server 130 (FIG. 1) may receive messages 123(FIG. 1) from communication module 124 (FIG. 1), when device 102(FIG. 1) is in standby mode, e.g., as described above.

As indicated at block 204, the method may include, receiving one or morepackets intended for the computing device from at least one applicationserver, when the computing device is in the standby mode. For example,VPN server 130 (FIG. 1) may receive one or more packets 138 (FIG. 1)indented for device 102 (FIG. 1) from at least one of AOAC applicationservers 137 (FIG. 1), when device 102 (FIG. 1) is in the standby mode,e.g., as described above.

As indicated at block 207, the method may include detecting at least onetargeted packet of the packets to be provided to the computing devicebased on the filtering criterion. For example, VPN server 130 (FIG. 1)may detect targeted packet 139 (FIG. 1) to be provided to device 102(FIG. 1) based on one or more filtering criterions 136, e.g., asdescribed above.

As indicated at block 209, the method may include transferring thetargeted packet via a Virtual-Private-Network (VPN) tunnel.

In some demonstrative embodiments, the computing device may be capableof switching the mode of operation of device 102 from the standby modeto the active mode upon receiving the targeted packet via the VPNtunnel. For example, VPN server 130 (FIG. 1) may transfer packet 139(FIG. 1) to device 102 (FIG. 1) via VPN tunnel 109 (FIG. 1), e.g., asdescribed above.

In some demonstrative embodiments, the computing device may deactivatethe VPN tunnel when operating in the standby mode. Accordingly, asindicated at block 208, the method may include sending to the computingdevice a wake packet, e.g., out of the VPN tunnel, to cause thecomputing device to switch from the standby mode to the active mode,prior to transferring the targeted packet to the computing device viathe VPN tunnel. For example, VPN server 130 (FIG. 1) may send wakepacket 132 (FIG. 1) to cause device 102 (FIG. 1) to switch from thestandby mode to the active mode, e.g., as described above.

Reference is made to FIG. 3, which schematically illustrates an articleof manufacture 300, in accordance with some demonstrative embodiments.Article 300 may include a machine-readable storage medium 302 to storelogic 304, which may be used, for example, to perform at least part ofthe functionality of device 102 (FIG. 1), the functionality of VPNserver 130 (FIG. 1) and/or to perform one or more operations of themethod of FIG. 2.

In some demonstrative embodiments, article 300 and/or machine-readablestorage medium 302 may include one or more types of computer-readablestorage media capable of storing data, including volatile memory,non-volatile memory, removable or non-removable memory, erasable ornon-erasable memory, writeable or re-writeable memory, and the like. Forexample, machine-readable storage medium 302 may include, RAM, DRAM,Double-Data-Rate DRAM (DDR-DRAM), SDRAM, static RAM (SRAM), ROM,programmable ROM (PROM), erasable programmable ROM (EPROM), electricallyerasable programmable ROM (EEPROM), Compact Disk ROM (CD-ROM), CompactDisk Recordable (CD-R), Compact Disk Rewriteable (CD-RW), flash memory(e.g., NOR or NAND flash memory), content addressable memory (CAM),polymer memory, phase-change memory, ferroelectric memory,silicon-oxide-nitride-oxide-silicon (SONOS) memory, a disk, a floppydisk, a hard drive, an optical disk, a magnetic disk, a card, a magneticcard, an optical card, a tape, a cassette, and the like. Thecomputer-readable storage media may include any suitable media involvedwith downloading or transferring a computer program from a remotecomputer to a requesting computer carried by data signals embodied in acarrier wave or other propagation medium through a communication link,e.g., a modem, radio or network connection.

In some demonstrative embodiments, logic 304 may include instructions,data, and/or code, which, if executed by a machine, may cause themachine to perform a method, process and/or operations as describedherein. The machine may include, for example, any suitable processingplatform, computing platform, computing device, processing device,computing system, processing system, computer, processor, or the like,and may be implemented using any suitable combination of hardware,software, firmware, and the like.

In some demonstrative embodiments, logic 304 may include, or may beimplemented as, software, a software module, an application, a program,a subroutine, instructions, an instruction set, computing code, words,values, symbols, and the like. The instructions may include any suitabletype of code, such as source code, compiled code, interpreted code,executable code, static code, dynamic code, and the like. Theinstructions may be implemented according to a predefined computerlanguage, manner or syntax, for instructing a processor to perform acertain function. The instructions may be implemented using any suitablehigh-level, low-level, object-oriented, visual, compiled and/orinterpreted programming language, such as C, C++, Java, BASIC, Matlab,Pascal, Visual BASIC, assembly language, machine code, and the like.

Functions, operations, components and/or features described herein withreference to one or more embodiments, may be combined with, or may beutilized in combination with, one or more other functions, operations,components and/or features described herein with reference to one ormore other embodiments, or vice versa.

While certain features of the invention have been illustrated anddescribed herein, many modifications, substitutions, changes, andequivalents may occur to those skilled in the art. It is, therefore, tobe understood that the appended claims are intended to cover all suchmodifications and changes as fall within the true spirit of theinvention.

The invention claimed is:
 1. A system comprising: aVirtual-Private-Network (VPN) server to communicate with at least onecomputing device via a VPN tunnel, the VPN server configured to receivefrom said computing device a mode indication indicating that saidcomputing device is in a standby power mode, the VPN server to receivefrom at least one application server one or more packets for saidcomputing device when said computing device is in said standby powermode, said VPN server is configured to detect at least one targetedpacket to be provided to said computing device based on at least onefiltering criterion, the filtering criterion defining one or moreattributes to trigger waking up the computing device from the standbypower mode, said VPN server is configured to transfer said targetedpacket to said computing device via said VPN tunnel, said VPN server isconfigured to send to said application server one or more messagesindicating that said computing device is in an active power mode, whensaid computing device is in said standby power mode.
 2. The system ofclaim 1, wherein said VPN server is configured to, prior to transferringsaid targeted packet, send to said computing device a wake packet totrigger said computing device to switch from said standby power mode tosaid active power mode.
 3. The system of claim 1, wherein said VPNserver is to receive said filtering criterion from said computingdevice.
 4. The system of claim 1, wherein said filtering criterioncomprises a filtering policy to be applied to a group of computingdevices including said computing device.
 5. The system of claim 1,wherein said one or more messages comprise periodic keep-alive messages.6. The system of claim 1, wherein said VPN server is configured toprocess one or more messages from said computing device indicating thata connection between said computing device and said VPN server is to bemaintained, when said computing device is in said standby power mode. 7.The system of claim 1, wherein said VPN server is to receive said modeindication via an Application-Programming-Interface (API) between saidVPN server and said computing device.
 8. The system of claim 1, whereinsaid VPN server is to receive said mode indication via said VPN tunnel.9. A device comprising: a communication module to communicate with aVirtual-Private-Network (VPN) server over a communication channel; VPNclient module to communicate with said VPN server via a VPN tunnel; andan agent module to provide to said VPN server a mode indicationindicating that said device is operating in a standby power mode, inwhich said VPN server is to apply at least one filtering criterion toone or more packets, received from at least one application server whensaid device is in said standby power mode, to detect at least onetargeted packet to be provided to said device, the filtering criteriondefining one or more attributes to trigger waking up the device from thestandby power mode, wherein said communication module is to send to saidVPN server one or more messages indicating that connection between saidVPN client module and said VPN server is to be maintained, when saiddevice is in said standby power mode.
 10. The device of claim 9, whereinsaid communication module, is configured to receive a wake packet fromsaid VPN server, prior to receiving said targeted packet, and to causesaid device to switch from said standby power mode to an active powermode upon receiving said wake packet.
 11. The device of claim 9, whereinsaid one or more messages comprise periodic keep-alive messages.
 12. Thedevice of claim 9, wherein said VPN client module is to cause saiddevice to switch from said standby power mode to an active power modeupon receiving said targeted packet.
 13. The device of claim 9, whereinsaid agent module is to provide said filtering criterion to said VPNserver.
 14. The device of claim 9, wherein said filtering criterioncomprises a filtering policy to be applied to a group of devicesincluding said device.
 15. The device of claim 9, wherein said agentmodule is to communicate with said VPN server via anApplication-Programming-Interface (API).
 16. The device of claim 9,wherein said agent module is to transfer to said VPN server via said VPNtunnel an indication that said device is operating in the standby powermode.
 17. A method comprising: sending to at least one applicationserver one or more messages indicating that a computing device is in anactive power mode, when said computing device is in a standby powermode; receiving from the at least one application server one or morepackets for the computing device, when said computing device is in thestandby power mode; based on at least one filtering criterion, detectingat least one targeted packet of said one or more packets to be providedto said computing device, the filtering criterion defining one or moreattributes to trigger waking up the computing device from the standbypower mode; and transferring said targeted packet to said computingdevice via a Virtual-Private-Network (VPN) tunnel.
 18. The method ofclaim 17 comprising sending to said computing device a wake packet,prior to transferring said targeted packet, to trigger said computingdevice to switch from said standby power mode to the active power mode.19. The method of claim 17 comprising receiving said filtering criterionfrom said computing device.
 20. The method of claim 17, wherein saidfiltering criterion comprises a filtering policy to be applied to agroup of computing devices including said computing device.
 21. Themethod of claim 17 comprising receiving from said computing device oneor more messages indicating that a connection with said computing deviceis to be maintained, when said computing device is in said standby powermode.